Cyber hygiene: the essential controls for people and small organisations

What cyber hygiene means

Personal hygiene is a set of small habits that prevent most illness. Cyber hygiene is the same idea for computers: simple, regular actions that prevent most common attacks. It is not exciting, and it does not need expensive products. It does need consistency, because one forgotten laptop or one shared admin password is often all an attacker needs.

Government agencies and vendors all publish similar advice. In the UK, the National Cyber Security Centre (NCSC) backs the Cyber Essentials scheme, which reduces the basics to five technical controls that a small organisation can certify against.

The five core controls

1. Firewalls. Every internet connection and every device has a firewall turned on, with default passwords changed and unneeded rules removed.
2. Secure configuration. Remove software and accounts you do not need, change default settings and turn off features such as auto-run.
3. User access control. Each person has their own account, admin rights are given only when needed, and MFA protects cloud services and remote access.
4. Malware protection. Use the protection built into modern operating systems or an EDR product, and allow only approved apps where possible.
5. Security update management. Keep all software supported and install high-risk and critical updates quickly; Cyber Essentials expects this within 14 days of release.

Cyber Essentials does not test backups, but every incident responder will tell you they matter most on the worst day. Keep at least one copy offline or immutable, and test restoring from it.

Hygiene for individuals

• Use a password manager and long, unique passphrases. See strong passwords and MFA.
• Turn on MFA for email, banking and social media first, because those accounts unlock everything else.
• Let phones, browsers and operating systems update automatically.
• Be suspicious of urgent messages and check them another way. See spotting phishing.
• Back up photos and documents to a second place.

Making hygiene stick

Hygiene fails slowly: a new laptop arrives without updates turned on, a leaver's account stays active, a router's firmware falls years behind. A short monthly check of devices, accounts and updates, with a named owner for each gap, keeps standards from drifting. Measure a few simple things, such as the percentage of devices fully updated and the number of accounts without MFA.

Hygiene for remote and mobile working

Laptops and phones that leave the office need the same basics. Encrypt their storage so a lost device does not mean lost data, require a screen lock, and manage them centrally so updates and settings apply wherever they are. Home routers count too: change the default admin password and keep firmware updated. Public Wi-Fi is less risky than it used to be because most services use encryption, but a company VPN or a phone hotspot is still the safer choice for admin work.

Real-world example: a primary school office

A small primary school wants Cyber Essentials to meet a funding condition. The self-assessment shows three gaps: the office PCs run with admin rights, the Wi-Fi router still has its default admin password, and two old laptops run an unsupported operating system. The IT technician removes local admin rights and creates a separate admin account, changes the router password and updates its firmware, and replaces the two laptops. Teachers barely notice the changes, and the school passes the assessment.